264 matches found
WordPress Plugin LearnPress Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-15010 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description: The issue is related to time-based SQL Injection via the order by parameter due to insufficient escaping on the user supplied parameter and lack of sufficient...
PT-2024-4517 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description: The issue is related to the LearnPress plugin for WordPress, which is vulnerable to command injection in all versions up to, and including, 4.2.5.7. This...
WordPress LearnPress Plugin <= 4.2.5.7 is vulnerable to Insecure Direct Object References (IDOR)
Software LearnPress Type Plugin Vulnerable versions = 4.2.5.7 Fixed in 4.2.5.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6223 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d81a8f21bcf7 Credits lttn Required...
LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Make a logged in admin open v...
The vulnerability of the LearnPress plugin of the WordPress content management system allows a hacker to carry out XSS attacks.
The vulnerability of the LearnPress plugin for WordPress content management systems exists due to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
Exploit for SQL Injection in Thimpress Learnpress
CVE-2022-45808 LearnPress Plugin 4.2.0 - Unauthenticated...
Exploit for Unrestricted Upload of File with Dangerous Type in Thimpress Learnpress
CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated...
WordPress LearnPress Plugin <= 4.2.3 is vulnerable to Broken Access Control
Software LearnPress Type Plugin Vulnerable versions = 4.2.3 Fixed in 4.2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36515 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 5c7b12ada2f1 Credits Rafie Muhammad Patchstack...
WordPress LearnPress Plugin <= 4.2.3 is vulnerable to Broken Access Control
Software LearnPress Type Plugin Vulnerable versions = 4.2.3 Fixed in 4.2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36516 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 9d39c7dfcdce Credits Rafie Muhammad Patchstack...
CVE-2022-47615
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45820
SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45808
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45808
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45820 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-47615 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-47615 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
PT-2023-14768 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions prior to 4.1.7.3.2 Description: A SQL Injection SQLi issue has been identified. This type of issue generally involves the manipulation of database queries, potentially allowing unauthorized access or...
LearnPress Plugin < 4.2.0 - Subscriber+ SQLi
The plugin does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks Note: The original advisory mentioned that the issue is only exploitable by contributors, b...
